[30587] in Kerberos
Principal attributes and policy in LDAP Realm
daemon@ATHENA.MIT.EDU (Azhar K Mustapha)
Fri Jan 2 17:50:44 2009
From: "Azhar K Mustapha" <azhar@nervesis.com.my>
To: <kerberos@mit.edu>
Date: Fri, 2 Jan 2009 20:33:03 +0800
Message-ID: <000001c96cd6$425e7ea0$c71b7be0$@com.my>
MIME-Version: 1.0
Content-Language: en-us
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Dear all.
I have been trying to use Kerberos with kdb ldap backend (openldap 2.4.11).
I have using two ldap servers to emulate multimaster environment for
Kerberos. There are some funny things happened.
1. If I don't enable multimaster replication using ldap, using kadmin.
I can add a Kerberos user, and I can run 'getprinc' command of that user
2. If I enable the multimaster setting with ldap, using kadmin, I can
add a Kerberos user, however, I will get segmentation fault when running
'getprinc' of that user.
Later, I try to use gdb to notice behavior of kadmin. I found out the
segmentation fault happens because in the multimaster setting, the number of
keys generated for the users are 3 instead of 2 in a no multi-masterl
condition, thus, giving a segmentation fault.
Next, I theorize as below,
1. There is a problem with openldap 2.4.11 replication when it comes
to replication binary data of krbPrincipalKey and krbExtraData (data
corruption)
2. Or, there is a problem with kdb ldap itself.
I think this problem is too fundamental for me to fix it myself. Therefore I
am resorting to use the non-ldap storage for Kerberos backend
Azhar
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
